@bastani/atomic 0.9.26-alpha.5 → 0.9.26

package/dist/builtin/workflows/src/extension/index.bundle.mjs

@@ -206,6 +206,602 @@ var init_dbos_admission = __esm(() => {
   dbosAdmissionContext = bag[key2];
 });
 
+// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
+function fenceDbosAdmissionPool(pool) {
+  const connect = pool.connect.bind(pool);
+  async function acquire(signal) {
+    if (signal.aborted)
+      throw sdkDependencyError();
+    const pending = connect().then((client) => {
+      if (signal.aborted) {
+        client.release(true);
+        throw sdkDependencyError();
+      }
+      return fencedClient(client, signal);
+    });
+    try {
+      return await raceAbort(pending, signal);
+    } catch (error) {
+      throw databaseError(error, signal);
+    }
+  }
+  function scopedConnect(callback) {
+    const signal = dbosAdmissionContext.getStore();
+    if (signal === undefined) {
+      if (callback === undefined)
+        return connect();
+      connect(callback);
+      return;
+    }
+    const pending = acquire(signal);
+    if (callback === undefined)
+      return pending;
+    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+  }
+  pool.connect = scopedConnect;
+  return pool;
+}
+function fencedClient(client, signal) {
+  let released = false;
+  const release = (error) => {
+    if (released)
+      return;
+    released = true;
+    signal.removeEventListener("abort", abort);
+    client.release(error);
+  };
+  const abort = () => release(true);
+  signal.addEventListener("abort", abort, { once: true });
+  const query = new Proxy(client.query, {
+    apply(target, _receiver, args) {
+      const values = [...args];
+      const last = values.at(-1);
+      const callback = typeof last === "function" ? values.pop() : undefined;
+      const pending = (async () => {
+        if (signal.aborted || released)
+          throw sdkDependencyError();
+        try {
+          return await raceAbort(new Promise((resolve, reject) => {
+            Reflect.apply(target, client, [
+              ...values,
+              (error, result) => {
+                if (error)
+                  reject(error);
+                else
+                  resolve(result);
+              }
+            ]);
+          }), signal);
+        } catch (error) {
+          throw databaseError(error, signal);
+        }
+      })();
+      if (callback === undefined)
+        return pending;
+      pending.then((result) => callback(null, result), (error) => callback(error));
+    }
+  });
+  return new Proxy(client, {
+    get(target, property, receiver) {
+      if (property === "query")
+        return query;
+      if (property === "release")
+        return release;
+      return Reflect.get(target, property, receiver);
+    }
+  });
+}
+function sdkDependencyError(message) {
+  const reported = message === undefined ? new DbosDependencyError : new DbosDependencyError(message, null);
+  return new DbosDependencyError(undefined, null, reported.message);
+}
+function databaseError(error, signal) {
+  if (signal?.aborted)
+    return sdkDependencyError();
+  if (isDbosDependencyError(error))
+    return sdkDependencyError(error.admissionDetail ?? error.message);
+  const pending = [error];
+  const seen = new Set;
+  while (pending.length > 0) {
+    const value2 = pending.pop();
+    if (typeof value2 !== "object" || value2 === null || seen.has(value2))
+      continue;
+    seen.add(value2);
+    if ("cause" in value2)
+      pending.push(value2.cause);
+    if ("error" in value2)
+      pending.push(value2.error);
+    if ("errors" in value2 && Array.isArray(value2.errors))
+      pending.push(...value2.errors);
+    const code = "code" in value2 && typeof value2.code === "string" ? value2.code : undefined;
+    const message = value2 instanceof Error ? value2.message : "";
+    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
+      return sdkDependencyError();
+    }
+  }
+  return error;
+}
+var connectionErrnos, connectionMessages;
+var init_dbos_admission_pool = __esm(() => {
+  init_dbos_admission();
+  connectionErrnos = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ECONNABORTED",
+    "EHOSTUNREACH",
+    "ENETUNREACH",
+    "ETIMEDOUT",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "EPIPE"
+  ]);
+  connectionMessages = new Set([
+    "Connection terminated unexpectedly",
+    "Connection terminated due to connection timeout",
+    "Client has encountered a connection error and is not queryable",
+    "timeout exceeded when trying to connect",
+    "Client was closed and is not queryable",
+    "Postgres connection pool changed while acquiring a connection"
+  ]);
+});
+
+// dist/builtin/workflows/src/durable/dbos-row-guard.ts
+import { createHash as createHash2 } from "node:crypto";
+async function installDbosRowGuard(client) {
+  const ready = await client.query("SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS status, to_regclass('dbos.operation_outputs') IS NOT NULL AS operations");
+  if (!ready.rows[0]?.status && !ready.rows[0]?.operations)
+    return;
+  if (!ready.rows[0]?.status || !ready.rows[0]?.operations)
+    throw new Error("Atomic workflow database schema is incomplete");
+  if (await validateInstalledGuard(client))
+    return;
+  await client.query("BEGIN");
+  try {
+    await client.query("SELECT pg_advisory_xact_lock(3419, 9003)");
+    if (await validateInstalledGuard(client)) {
+      await client.query("COMMIT");
+      return;
+    }
+    await client.query(guardSql);
+    await client.query("CREATE TABLE IF NOT EXISTS dbos.atomic_guard_protocol (singleton boolean PRIMARY KEY CHECK(singleton), fingerprint text NOT NULL)");
+    await client.query("INSERT INTO dbos.atomic_guard_protocol VALUES (true, $1) ON CONFLICT DO NOTHING", [
+      fingerprint
+    ]);
+    await client.query("COMMIT");
+  } catch (error) {
+    await client.query("ROLLBACK");
+    throw error;
+  }
+}
+async function validateInstalledGuard(client) {
+  const installed = await client.query("SELECT to_regclass('dbos.atomic_guard_protocol') IS NOT NULL AS present");
+  if (!installed.rows[0]?.present)
+    return false;
+  const validated = await client.query("SELECT fingerprint, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid IN ('dbos.workflow_status'::regclass,'dbos.operation_outputs'::regclass) AND tgname = 'atomic_generation_guard' AND tgenabled = 'O' AND tgtype = 31 AND tgfoid = 'dbos.atomic_guard_row()'::regprocedure) AS triggers, (SELECT count(*)::int FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection' AND tgenabled = 'O' AND tgtype = 21 AND tgfoid = 'dbos.atomic_project_metadata()'::regprocedure) AS projections FROM dbos.atomic_guard_protocol WHERE singleton");
+  if (validated.rows.length !== 1 || validated.rows[0].fingerprint !== fingerprint || validated.rows[0].triggers !== 2 || validated.rows[0].projections !== 1)
+    throw new Error("Atomic database ownership guard schema is incompatible or incomplete");
+  return true;
+}
+var guardSql = `
+CREATE TABLE IF NOT EXISTS dbos.atomic_owner_generation (
+ root text PRIMARY KEY, owner text, generation bigint,
+ terminal boolean NOT NULL DEFAULT false, claim text, claimant text, protocol integer NOT NULL DEFAULT 1 CHECK(protocol = 1)
+);
+CREATE TABLE IF NOT EXISTS dbos.atomic_guard_rows (workflow_uuid text PRIMARY KEY, root text NOT NULL);
+CREATE OR REPLACE FUNCTION dbos.atomic_metadata(value text) RETURNS jsonb
+LANGUAGE plpgsql IMMUTABLE SET search_path = pg_catalog AS $$
+DECLARE decoded jsonb;
+BEGIN
+ IF value IS NULL THEN RETURN NULL; END IF;
+ BEGIN decoded := value::jsonb; EXCEPTION WHEN invalid_text_representation THEN RETURN NULL; END;
+ IF decoded->>'__dbos_serializer' = 'superjson' THEN decoded := decoded->'json'; END IF;
+ IF decoded->>'__atomicDurableMetadata' IS DISTINCT FROM 'true' OR decoded->>'version' IS DISTINCT FROM '3' THEN RETURN NULL; END IF;
+ RETURN decoded->'metadata';
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_guard_row() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE
+ row_value jsonb; id text; root_id text; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE;
+ meta jsonb; prior jsonb; prior_generation bigint; next_generation bigint; absorbing boolean;
+ allowed boolean; cap_owner text; cap_generation bigint; claim_token text;
+BEGIN
+ row_value := CASE WHEN TG_OP = 'DELETE' THEN to_jsonb(OLD) ELSE to_jsonb(NEW) END;
+ id := row_value->>'workflow_uuid';
+ root_id := split_part(id, ':checkpoint:', 1);
+ IF TG_OP = 'UPDATE' AND to_jsonb(OLD)->>'workflow_uuid' IS DISTINCT FROM id AND (
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid') OR
+  (TG_TABLE_NAME = 'workflow_status' AND to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')) OR
+  (TG_TABLE_NAME = 'operation_outputs' AND EXISTS(SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = to_jsonb(OLD)->>'workflow_uuid' AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')))
+ ) THEN
+  IF NULLIF(current_setting('atomic.row_authority',true),'') IS NULL OR current_setting('atomic.row_authority',true) = 'null' THEN RETURN NULL; END IF;
+  RAISE EXCEPTION 'Atomic workflow identities are immutable';
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND NOT (
+  COALESCE(row_value->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  COALESCE(to_jsonb(OLD)->>'name' IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint'), false) OR
+  EXISTS(SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id)
+ ) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ IF TG_TABLE_NAME = 'operation_outputs' AND NOT EXISTS (
+  SELECT 1 FROM dbos.workflow_status WHERE workflow_uuid = id AND name IN ('atomicWorkflowHandle','atomicWorkflowCheckpoint')
+ ) AND NOT EXISTS (SELECT 1 FROM dbos.atomic_guard_rows WHERE workflow_uuid = id) THEN
+  IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+ END IF;
+ INSERT INTO dbos.atomic_guard_rows VALUES(id, root_id) ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_guard_rows SELECT workflow_uuid, root_id FROM dbos.workflow_status
+  WHERE workflow_uuid = root_id AND name = 'atomicWorkflowHandle' ON CONFLICT DO NOTHING;
+ INSERT INTO dbos.atomic_owner_generation(root) VALUES(root_id)
+  ON CONFLICT(root) DO UPDATE SET root = EXCLUDED.root RETURNING * INTO state;
+ IF state.owner IS NULL THEN
+  IF TG_TABLE_NAME <> 'workflow_status' OR TG_OP = 'DELETE' OR row_value->>'status' <> 'SUCCESS'
+   OR id NOT LIKE root_id || ':checkpoint:__atomic_metadata:%'
+   OR authority->>'root' IS DISTINCT FROM root_id OR authority->>'enroll' IS DISTINCT FROM 'true' THEN
+   IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+  END IF;
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id THEN
+   RAISE EXCEPTION 'Atomic metadata encoding is unavailable for enrollment';
+  END IF;
+  SELECT candidate.metadata, candidate.generation INTO prior, prior_generation FROM (
+   SELECT dbos.atomic_metadata(output) AS metadata,
+    split_part(substring(workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint AS generation
+   FROM dbos.workflow_status
+   WHERE workflow_uuid LIKE root_id || ':checkpoint:__atomic_metadata:%' AND status = 'SUCCESS'
+  ) candidate WHERE candidate.metadata IS NOT NULL
+  ORDER BY COALESCE(candidate.metadata->>'status' IN ('completed', 'cancelled') OR
+   (candidate.metadata->>'status' IN ('failed','blocked') AND candidate.metadata->>'resumable' = 'false'), false) DESC,
+   candidate.generation DESC LIMIT 1;
+  IF prior_generation IS DISTINCT FROM (authority->>'generation')::bigint
+   OR prior->>'ownerExecutorId' IS DISTINCT FROM authority->>'owner' THEN
+   RAISE EXCEPTION 'Atomic ownership generation changed before enrollment';
+  END IF;
+ ELSE
+  IF authority->>'root' IS DISTINCT FROM root_id THEN RETURN NULL; END IF;
+  cap_owner := authority->>'owner'; cap_generation := (authority->>'generation')::bigint;
+  allowed := cap_owner = state.owner AND cap_generation = state.generation AND (
+   authority->>'actor' = state.owner OR
+   (authority->>'claim' = state.claim AND authority->>'actor' = state.claimant) OR
+   (authority->>'claim' IS NOT NULL AND authority->>'checkpoint' = id));
+  IF NOT COALESCE(allowed, false) THEN RAISE EXCEPTION 'Atomic ownership generation changed; stale database writes are refused'; END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP = 'UPDATE' THEN
+  IF OLD.status = 'SUCCESS' AND OLD.name = 'atomicWorkflowCheckpoint' THEN
+   IF NEW.output IS DISTINCT FROM OLD.output OR NEW.status <> 'SUCCESS' THEN RAISE EXCEPTION 'Completed Atomic checkpoints are immutable'; END IF;
+   RETURN NEW;
+  END IF;
+ END IF;
+ IF TG_TABLE_NAME = 'workflow_status' AND TG_OP <> 'DELETE' AND row_value->>'status' = 'SUCCESS'
+  AND id LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN
+  meta := dbos.atomic_metadata(row_value->>'output');
+  IF meta IS NULL OR meta->>'workflowId' IS DISTINCT FROM root_id OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN RAISE EXCEPTION 'Atomic metadata encoding or owner is unavailable'; END IF;
+  next_generation := split_part(substring(id FROM length(root_id) + 13), ':', 2)::bigint;
+  absorbing := COALESCE(meta->>'status' IN ('completed', 'cancelled') OR
+   (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+  claim_token := meta->>'transitionClaimId';
+  IF state.root IS NOT NULL AND (next_generation < state.generation OR (state.terminal AND NOT absorbing)) THEN
+   RAISE EXCEPTION 'Atomic terminal or newer generation cannot be overwritten';
+  END IF;
+  IF state.owner IS NOT NULL AND authority->>'actor' <> state.owner THEN
+   IF id NOT LIKE '%:claim' OR next_generation <> state.generation + 1 OR claim_token IS DISTINCT FROM authority->>'claim' OR meta->>'ownerExecutorId' IS DISTINCT FROM authority->>'actor' THEN
+    RAISE EXCEPTION 'Atomic ownership transfer requires an exact generation claim';
+   END IF;
+  END IF;
+ END IF;
+ IF TG_OP = 'DELETE' THEN RETURN OLD; ELSE RETURN NEW; END IF;
+END $$;
+CREATE OR REPLACE FUNCTION dbos.atomic_project_metadata() RETURNS trigger
+LANGUAGE plpgsql SET search_path = pg_catalog AS $$
+DECLARE root_id text; meta jsonb; authority jsonb; state dbos.atomic_owner_generation%ROWTYPE; projected_generation bigint; absorbing boolean;
+BEGIN
+ IF NEW.name <> 'atomicWorkflowCheckpoint' OR NEW.status <> 'SUCCESS' THEN RETURN NEW; END IF;
+ root_id := split_part(NEW.workflow_uuid, ':checkpoint:', 1);
+ IF NEW.workflow_uuid NOT LIKE root_id || ':checkpoint:__atomic_metadata:%' THEN RETURN NEW; END IF;
+ IF TG_OP = 'UPDATE' THEN IF OLD.status = 'SUCCESS' THEN RETURN NEW; END IF; END IF;
+ authority := NULLIF(current_setting('atomic.row_authority', true), '')::jsonb;
+ SELECT * INTO state FROM dbos.atomic_owner_generation WHERE root = root_id FOR UPDATE;
+ IF state.owner IS NULL AND authority->>'enroll' IS DISTINCT FROM 'true' THEN RETURN NEW; END IF;
+ meta := dbos.atomic_metadata(NEW.output);
+ projected_generation := split_part(substring(NEW.workflow_uuid FROM length(root_id) + 13), ':', 2)::bigint;
+ absorbing := COALESCE(meta->>'status' IN ('completed','cancelled') OR (meta->>'status' IN ('failed','blocked') AND meta->>'resumable' = 'false'), false);
+ UPDATE dbos.atomic_owner_generation SET owner = meta->>'ownerExecutorId', generation = projected_generation,
+  terminal = absorbing, claim = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN meta->>'transitionClaimId' END,
+  claimant = CASE WHEN NEW.workflow_uuid LIKE '%:claim' THEN authority->>'actor' END WHERE root = root_id;
+ RETURN NEW;
+END $$;
+DO $$ BEGIN
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.operation_outputs'::regclass AND tgname = 'atomic_generation_guard') THEN
+  CREATE TRIGGER atomic_generation_guard BEFORE INSERT OR UPDATE OR DELETE ON dbos.operation_outputs
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_guard_row();
+ END IF;
+ IF NOT EXISTS (SELECT 1 FROM pg_trigger WHERE tgrelid = 'dbos.workflow_status'::regclass AND tgname = 'atomic_generation_projection') THEN
+  CREATE TRIGGER atomic_generation_projection AFTER INSERT OR UPDATE ON dbos.workflow_status
+   FOR EACH ROW EXECUTE FUNCTION dbos.atomic_project_metadata();
+ END IF;
+END $$;
+`, fingerprint;
+var init_dbos_row_guard = __esm(() => {
+  fingerprint = createHash2("sha256").update(guardSql).digest("hex");
+});
+
+// dist/builtin/workflows/src/durable/dbos-owner-fence.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+import { createHash as createHash3 } from "node:crypto";
+function lockKey(identity) {
+  const digest = createHash3("sha256").update(`atomic-workflow-fence:${identity}`).digest();
+  return [digest.readInt32BE(0), digest.readInt32BE(4)];
+}
+function isDatabaseExecutor(executorId) {
+  return /^atomic-db-[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(executorId ?? "");
+}
+
+class DbosOwnerFence {
+  pool;
+  executorId;
+  endPool;
+  lifetime;
+  lost = false;
+  closing;
+  closed = false;
+  get invalidated() {
+    return this.lost;
+  }
+  constructor(pool, executorId, endPool) {
+    this.pool = pool;
+    this.executorId = executorId;
+    this.endPool = endPool;
+  }
+  fail() {
+    this.lost = true;
+    return new DbosDependencyError("Workflow database unavailable: ownership connection was lost; this execution generation cannot write again");
+  }
+  owner() {
+    if (this.lost)
+      return Promise.reject(this.fail());
+    this.lifetime ??= (async () => {
+      const client = await this.pool().connect();
+      client.on("error", () => {
+        this.fail();
+      });
+      client.on("end", () => {
+        this.fail();
+      });
+      try {
+        await client.query("SELECT set_config('application_name', $1, false)", [`atomic-owner:${this.executorId}`]);
+        const held = await client.query("SELECT pg_try_advisory_lock($1, $2) AS held", [
+          ...lockKey(this.executorId)
+        ]);
+        if (!held.rows[0]?.held || this.lost)
+          throw this.fail();
+        await client.query("SELECT pg_advisory_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+        await client.query("SELECT pg_advisory_unlock($1, $2)", [...lockKey(this.executorId)]);
+        return client;
+      } catch (error) {
+        this.fail();
+        client.release(true);
+        throw error;
+      }
+    })().catch((error) => {
+      this.fail();
+      throw error;
+    });
+    return this.lifetime;
+  }
+  async liveness(executorId) {
+    if (!isDatabaseExecutor(executorId))
+      return "unknown";
+    const client = await this.pool().connect();
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      return result.rows[0]?.held ? "dead" : "alive";
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.release();
+      }
+    }
+  }
+  async recover(executorId, callback) {
+    if (!isDatabaseExecutor(executorId))
+      return;
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      const result = await client.query("SELECT pg_try_advisory_xact_lock($1, $2) AS held", [
+        ...lockKey(executorId)
+      ]);
+      if (!result.rows[0]?.held)
+        return;
+      return await callback();
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async write(workflowId, callback, claim = false) {
+    try {
+      return await this.writeLocked(workflowId, callback, claim);
+    } catch (error) {
+      const mapped = databaseError(error);
+      throw this.lost && isDbosDependencyError(mapped) ? this.fail() : mapped;
+    }
+  }
+  async writeLocked(workflowId, callback, claim) {
+    const context = writeContext.getStore();
+    const active = context?.fence === this ? context.workflows : undefined;
+    if (active?.has(workflowId)) {
+      if (this.lost)
+        throw this.fail();
+      return await callback();
+    }
+    const owner = await this.owner();
+    const client = await this.pool().connect();
+    const fail = () => {
+      this.fail();
+    };
+    client.on("error", fail);
+    client.on("end", fail);
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT set_config('application_name', $1, false)", [`atomic-guard:${workflowId}`]);
+      await client.query("SET LOCAL statement_timeout = '10000ms'");
+      await client.query("SELECT pg_advisory_xact_lock_shared($1, $2)", [...lockKey(this.executorId)]);
+      await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`workflow:${workflowId}`)]);
+      if (claim)
+        await client.query("SELECT pg_advisory_xact_lock($1, $2)", [...lockKey(`sql:${workflowId}`)]);
+      if (this.lost)
+        throw this.fail();
+      try {
+        await owner.query("SELECT 1");
+      } catch {
+        throw this.fail();
+      }
+      if (this.lost)
+        throw this.fail();
+      return await writeContext.run({ fence: this, workflows: new Map([...active ?? [], [workflowId, claim]]) }, callback);
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } finally {
+        client.removeListener("error", fail);
+        client.removeListener("end", fail);
+        client.release();
+      }
+    }
+  }
+  async withRowAuthority(authority, callback) {
+    return await rowContext.run(authority, callback);
+  }
+  protectPool(pool) {
+    const connect = pool.connect.bind(pool);
+    const acquire = async () => {
+      const active = writeContext.getStore();
+      const client = await connect();
+      try {
+        await installDbosRowGuard(client);
+        await client.query("SELECT set_config('atomic.row_authority', $1, false)", [
+          JSON.stringify(rowContext.getStore() ?? null)
+        ]);
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      if (active === undefined)
+        return client;
+      const fence = active.fence;
+      try {
+        if (fence.lost)
+          throw fence.fail();
+        await client.query("SELECT set_config('application_name', $1, false)", [
+          `atomic-sql:${[...active.workflows.keys()][0]}`
+        ]);
+        for (const identity of [
+          fence.executorId,
+          ...[...active.workflows].filter(([, claim]) => !claim).map(([id]) => `sql:${id}`)
+        ]) {
+          const held = await client.query("SELECT pg_try_advisory_lock_shared($1, $2) AS held", [...lockKey(identity)]);
+          if (!held.rows[0]?.held)
+            throw fence.fail();
+        }
+        try {
+          await (await fence.owner()).query("SELECT 1");
+        } catch {
+          throw fence.fail();
+        }
+        if (fence.lost)
+          throw fence.fail();
+      } catch (error) {
+        client.release(true);
+        throw error;
+      }
+      let released = false;
+      const release = () => {
+        if (released)
+          return;
+        released = true;
+        client.release(true);
+      };
+      const query = new Proxy(client.query, {
+        apply: (target, _receiver, args) => {
+          if (!fence.lost && !released)
+            return Reflect.apply(target, client, args);
+          const error = fence.fail();
+          const callback = args.at(-1);
+          if (typeof callback === "function") {
+            queueMicrotask(() => callback(error));
+            return;
+          }
+          return Promise.reject(error);
+        }
+      });
+      return new Proxy(client, {
+        get(target, property, receiver) {
+          if (property === "release")
+            return release;
+          if (property === "query")
+            return query;
+          return Reflect.get(target, property, receiver);
+        }
+      });
+    };
+    function scopedConnect(callback) {
+      const pending = acquire();
+      if (callback === undefined)
+        return pending;
+      pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
+    }
+    pool.connect = scopedConnect;
+    return pool;
+  }
+  close() {
+    this.closed = true;
+    this.lost = true;
+    this.closing ??= (async () => {
+      if (this.lifetime !== undefined) {
+        const client = await this.lifetime.catch(() => {
+          return;
+        });
+        client?.release(true);
+      }
+      await this.endPool();
+    })();
+    return this.closing;
+  }
+}
+var contextKey, contextBag, writeContext, rowContextKey, rowContextBag, rowContext;
+var init_dbos_owner_fence = __esm(() => {
+  init_dbos_admission();
+  init_dbos_admission_pool();
+  init_dbos_row_guard();
+  contextKey = Symbol.for("atomic-workflows/dbos-owner-write-context@1");
+  contextBag = globalThis;
+  contextBag[contextKey] ??= new AsyncLocalStorage2;
+  writeContext = contextBag[contextKey];
+  rowContextKey = Symbol.for("atomic-workflows/dbos-row-authority@1");
+  rowContextBag = globalThis;
+  rowContextBag[rowContextKey] ??= new AsyncLocalStorage2;
+  rowContext = rowContextBag[rowContextKey];
+});
+
 // ../../node_modules/@dbos-inc/dbos-sdk/dist/src/error.js
 var require_error = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -30362,145 +30958,6 @@ SELECT
   } });
 });
 
-// dist/builtin/workflows/src/durable/dbos-admission-pool.ts
-function fenceDbosAdmissionPool(pool) {
-  const connect = pool.connect.bind(pool);
-  async function acquire(signal) {
-    if (signal.aborted)
-      throw sdkDependencyError();
-    const pending = connect().then((client) => {
-      if (signal.aborted) {
-        client.release(true);
-        throw sdkDependencyError();
-      }
-      return fencedClient(client, signal);
-    });
-    try {
-      return await raceAbort(pending, signal);
-    } catch (error) {
-      throw databaseError(error, signal);
-    }
-  }
-  function scopedConnect(callback) {
-    const signal = dbosAdmissionContext.getStore();
-    if (signal === undefined) {
-      if (callback === undefined)
-        return connect();
-      connect(callback);
-      return;
-    }
-    const pending = acquire(signal);
-    if (callback === undefined)
-      return pending;
-    pending.then((client) => callback(undefined, client, client.release), (error) => callback(error, undefined, () => {}));
-  }
-  pool.connect = scopedConnect;
-  return pool;
-}
-function fencedClient(client, signal) {
-  let released = false;
-  const release = (error) => {
-    if (released)
-      return;
-    released = true;
-    signal.removeEventListener("abort", abort);
-    client.release(error);
-  };
-  const abort = () => release(true);
-  signal.addEventListener("abort", abort, { once: true });
-  const query = new Proxy(client.query, {
-    apply(target, _receiver, args) {
-      const values = [...args];
-      const last = values.at(-1);
-      const callback = typeof last === "function" ? values.pop() : undefined;
-      const pending = (async () => {
-        if (signal.aborted || released)
-          throw sdkDependencyError();
-        try {
-          return await raceAbort(new Promise((resolve, reject) => {
-            Reflect.apply(target, client, [
-              ...values,
-              (error, result) => {
-                if (error)
-                  reject(error);
-                else
-                  resolve(result);
-              }
-            ]);
-          }), signal);
-        } catch (error) {
-          throw databaseError(error, signal);
-        }
-      })();
-      if (callback === undefined)
-        return pending;
-      pending.then((result) => callback(null, result), (error) => callback(error));
-    }
-  });
-  return new Proxy(client, {
-    get(target, property, receiver) {
-      if (property === "query")
-        return query;
-      if (property === "release")
-        return release;
-      return Reflect.get(target, property, receiver);
-    }
-  });
-}
-function sdkDependencyError(message) {
-  const reported = message === undefined ? new DbosDependencyError : new DbosDependencyError(message, null);
-  return new DbosDependencyError(undefined, null, reported.message);
-}
-function databaseError(error, signal) {
-  if (signal.aborted)
-    return sdkDependencyError();
-  if (isDbosDependencyError(error))
-    return sdkDependencyError(error.admissionDetail ?? error.message);
-  const pending = [error];
-  const seen = new Set;
-  while (pending.length > 0) {
-    const value2 = pending.pop();
-    if (typeof value2 !== "object" || value2 === null || seen.has(value2))
-      continue;
-    seen.add(value2);
-    if ("cause" in value2)
-      pending.push(value2.cause);
-    if ("error" in value2)
-      pending.push(value2.error);
-    if ("errors" in value2 && Array.isArray(value2.errors))
-      pending.push(...value2.errors);
-    const code = "code" in value2 && typeof value2.code === "string" ? value2.code : undefined;
-    const message = value2 instanceof Error ? value2.message : "";
-    if (code !== undefined && (/^(?:08|53|57)[0-9A-Z]{3}$|^40003$/.test(code) || connectionErrnos.has(code)) || code === undefined && connectionMessages.has(message)) {
-      return sdkDependencyError();
-    }
-  }
-  return error;
-}
-var connectionErrnos, connectionMessages;
-var init_dbos_admission_pool = __esm(() => {
-  init_dbos_admission();
-  connectionErrnos = new Set([
-    "ECONNRESET",
-    "ECONNREFUSED",
-    "ECONNABORTED",
-    "EHOSTUNREACH",
-    "ENETUNREACH",
-    "ETIMEDOUT",
-    "ENOTFOUND",
-    "EAI_AGAIN",
-    "EPIPE"
-  ]);
-  connectionMessages = new Set([
-    "Connection terminated unexpectedly",
-    "Connection terminated due to connection timeout",
-    "Client has encountered a connection error and is not queryable",
-    "timeout exceeded when trying to connect",
-    "Client was closed and is not queryable",
-    "Postgres connection pool changed while acquiring a connection"
-  ]);
-});
-
 // dist/builtin/workflows/src/durable/dbos-default-postgres-url.ts
 function defaultPostgresUrl(database, host = process.env.PGHOST || "localhost", port = process.env.PGPORT || "5432") {
   const url = new URL("postgresql://localhost");
@@ -30790,7 +31247,7 @@ function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock
     url: health?.endpoint ?? systemDatabaseUrl,
     failure: health?.lastFailure?.message
   });
-  const createPool = () => {
+  const createPool = (fenced = true) => {
     let unsubscribe;
     const managed = createRecoverablePostgresPool(systemDatabaseUrl, {
       beforeConnect: health === undefined ? undefined : () => health.check(),
@@ -30800,14 +31257,38 @@ function configureAdmissionDatabase(sdk, config, launchLock = withDbosLaunchLock
     });
     unsubscribe = health?.subscribe(managed.invalidate);
     health?.start();
-    return fenceDbosAdmissionPool(managed.pool);
+    return fenced ? fenceDbosAdmissionPool(managed.pool) : managed.pool;
   };
   let pool = createPool();
+  const createFence = (executorId) => {
+    const fencePool = createPool(false);
+    const created = new DbosOwnerFence(() => fencePool, executorId, () => fencePool.end());
+    const owner = getDbosProcessOwner();
+    owner.executorFences ??= new Set;
+    owner.executorFences.add(created);
+    return created;
+  };
+  let fence = createFence(config.executorID);
+  getDbosProcessOwner().executorFence = fence;
+  getDbosProcessOwner().createExecutorFence = () => {
+    const executorId = `atomic-db-${crypto.randomUUID()}`;
+    getDbosProcessOwner().executorId = executorId;
+    const next = createFence(executorId);
+    getDbosProcessOwner().executorFence = next;
+    return next;
+  };
+  pool = fence.protectPool(pool);
   sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
   const launch = async () => {
+    if (fence.closed) {
+      const executorId = `atomic-db-${crypto.randomUUID()}`;
+      getDbosProcessOwner().executorId = executorId;
+      fence = createFence(executorId);
+      getDbosProcessOwner().executorFence = fence;
+    }
     if (pool.ended) {
-      pool = createPool();
-      sdk.setConfig({ ...config, systemDatabaseUrl, systemDatabasePool: pool });
+      pool = fence.protectPool(createPool());
+      sdk.setConfig({ ...config, executorID: fence.executorId, systemDatabaseUrl, systemDatabasePool: pool });
     }
     const urlToEnsure = health === undefined ? systemDatabaseUrl : await health.check();
     const result = await import_datasource2.ensurePGDatabase({ urlToEnsure, logger: () => {} });
@@ -30827,6 +31308,7 @@ var import_datasource2;
 var init_dbos_admission_config = __esm(() => {
   init_dbos_admission_pool();
   init_dbos_launch_lock();
+  init_dbos_owner_fence();
   init_dbos_process_owner();
   init_dbos_recoverable_pool();
   import_datasource2 = __toESM(require_datasource(), 1);
@@ -81463,7 +81945,7 @@ function getDurableBackendProcessOwner() {
 }
 
 // dist/builtin/workflows/src/durable/dbos-backend.ts
-import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+import { isDeepStrictEqual as isDeepStrictEqual3 } from "node:util";
 
 // dist/builtin/workflows/src/durable/format-version.ts
 var DURABLE_FORMAT_VERSION = 3;
@@ -82326,10 +82808,10 @@ function isForeignLiveWorkflow(candidate, localExecutorId, now = Date.now()) {
     return false;
   if (candidate.ownerExecutorId === undefined || candidate.ownerExecutorId === localExecutorId)
     return false;
-  return now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
+  return candidate.ownerLiveness === "alive" || now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
 }
 function isLiveRunningWorkflow(candidate, now = Date.now()) {
-  return candidate.status === "running" && now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS;
+  return candidate.status === "running" && (candidate.ownerLiveness === "alive" || now - candidate.updatedAt < FOREIGN_LIVE_WORKFLOW_WINDOW_MS);
 }
 
 // dist/builtin/workflows/src/durable/durable-hash.ts
@@ -82379,7 +82861,7 @@ class InMemoryDurableBackend {
   workflows = new Map;
   promptReservations = new Map;
   deletedWorkflowIds = new Set;
-  registerWorkflow(handle) {
+  registerWorkflow(handle, authoritativeOwner = false) {
     this.deletedWorkflowIds.delete(handle.workflowId);
     const existing = this.workflows.get(handle.workflowId);
     const completedCheckpoints = handle.completedCheckpoints ?? existing?.handle.completedCheckpoints ?? 0;
@@ -82393,7 +82875,7 @@ class InMemoryDurableBackend {
       status: handle.status,
       ...handle.invocationCwd !== undefined ? { invocationCwd: handle.invocationCwd } : existing?.handle.invocationCwd !== undefined ? { invocationCwd: existing.handle.invocationCwd } : {},
       ...handle.origin !== undefined ? { origin: handle.origin } : existing?.handle.origin !== undefined ? { origin: existing.handle.origin } : {},
-      modelOwner: existing?.handle.modelOwner ?? handle.modelOwner,
+      modelOwner: authoritativeOwner ? handle.modelOwner : existing?.handle.modelOwner ?? handle.modelOwner,
       ...handle.workflowCwd !== undefined ? { workflowCwd: handle.workflowCwd } : existing?.handle.workflowCwd !== undefined ? { workflowCwd: existing.handle.workflowCwd } : {},
       ...handle.repositoryRoot !== undefined ? { repositoryRoot: handle.repositoryRoot } : existing?.handle.repositoryRoot !== undefined ? { repositoryRoot: existing.handle.repositoryRoot } : {},
       ...handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: handle.gitWorktreeRoot } : existing?.handle.gitWorktreeRoot !== undefined ? { gitWorktreeRoot: existing.handle.gitWorktreeRoot } : {},
@@ -82407,7 +82889,9 @@ class InMemoryDurableBackend {
       ...handle.rootWorkflowId !== undefined ? { rootWorkflowId: handle.rootWorkflowId } : {},
       ...handle.resumable !== undefined ? { resumable: handle.resumable } : {},
       ...workflowFailureFields(hasWorkflowFailureMetadata(handle) ? handle : handle.status === "running" ? undefined : existing?.handle),
-      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {}
+      ...handle.ownerExecutorId !== undefined ? { ownerExecutorId: handle.ownerExecutorId } : existing?.handle.ownerExecutorId !== undefined ? { ownerExecutorId: existing.handle.ownerExecutorId } : {},
+      ...handle.ownerLiveness !== undefined ? { ownerLiveness: handle.ownerLiveness } : {},
+      ...handle.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {}
     };
     if (existing)
       existing.handle = full;
@@ -82557,11 +83041,14 @@ class InMemoryDurableBackend {
     if (pendingPrompts !== undefined)
       this.promptReservations.delete(workflowId);
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
-    const current = this.workflows.get(workflowId)?.handle;
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    const record = this.workflows.get(workflowId);
+    const current = record?.handle;
     if (current === undefined || !expected.includes(current.status) || expectedUpdatedAt !== undefined && current.updatedAt !== expectedUpdatedAt)
       return false;
     this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
+    if (modelOwner !== undefined && record !== undefined)
+      record.handle = { ...record.handle, modelOwner };
     return true;
   }
   adjustPendingPrompts(workflowId, delta) {
@@ -82634,6 +83121,7 @@ class InMemoryDurableBackend {
       pendingStageMessages: h.pendingStageMessages ?? [],
       ...h.possibleStages !== undefined ? { possibleStages: h.possibleStages } : {},
       ...h.ownerExecutorId !== undefined ? { ownerExecutorId: h.ownerExecutorId } : {},
+      ...h.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...h.sessionFile !== undefined ? { sessionFile: h.sessionFile } : {},
       ...h.label !== undefined ? { label: h.label } : {},
       ...h.rootWorkflowId !== undefined ? { rootWorkflowId: h.rootWorkflowId } : {},
@@ -85464,6 +85952,7 @@ function encodeMetadata(metadata) {
       } : {},
       ...metadata.ownerExecutorId !== undefined ? { ownerExecutorId: metadata.ownerExecutorId } : {},
       ...metadata.transitionClaimId !== undefined ? { transitionClaimId: metadata.transitionClaimId } : {},
+      ...metadata.legacyRecoveryPending === true ? { legacyRecoveryPending: true } : {},
       ...metadata.sessionFile !== undefined ? { sessionFile: metadata.sessionFile } : {},
       ...metadata.label !== undefined ? { label: metadata.label } : {},
       ...metadata.rootWorkflowId !== undefined ? { rootWorkflowId: metadata.rootWorkflowId } : {},
@@ -85526,7 +86015,7 @@ function parseDurableWorkflowMetadata(value2, workflowId) {
     return;
   const possibleStages = coercePossibleStages(serialized.possibleStages);
   const metadata = value2;
-  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
+  if (metadata.workflowId !== workflowId || typeof metadata.workflowId !== "string" || typeof metadata.name !== "string" || typeof metadata.inputs !== "object" || metadata.inputs === null || Array.isArray(metadata.inputs) || typeof metadata.status !== "string" || !isDurableWorkflowStatus(metadata.status) || typeof metadata.completedCheckpoints !== "number" || typeof metadata.createdAt !== "number" || typeof metadata.pendingPrompts !== "number" || typeof metadata.promptReservationEpoch !== "string" || typeof metadata.updatedAt !== "number" || metadata.ownerExecutorId !== undefined && typeof metadata.ownerExecutorId !== "string" || metadata.transitionClaimId !== undefined && typeof metadata.transitionClaimId !== "string" || metadata.legacyRecoveryPending !== undefined && metadata.legacyRecoveryPending !== true || metadata.sessionFile !== undefined && typeof metadata.sessionFile !== "string" || metadata.label !== undefined && typeof metadata.label !== "string" || metadata.rootWorkflowId !== undefined && typeof metadata.rootWorkflowId !== "string" || metadata.resumable !== undefined && typeof metadata.resumable !== "boolean" || metadata.exited !== undefined && typeof metadata.exited !== "boolean" || metadata.exitReason !== undefined && typeof metadata.exitReason !== "string" || metadata.error !== undefined && typeof metadata.error !== "string" || metadata.failureKind !== undefined && !isWorkflowFailureKind(metadata.failureKind) || metadata.failureCode !== undefined && !isWorkflowFailureCode(metadata.failureCode) || metadata.failureRecoverability !== undefined && !isWorkflowFailureRecoverability(metadata.failureRecoverability) || metadata.failureDisposition !== undefined && !isWorkflowFailureDisposition(metadata.failureDisposition) || metadata.failedToolNodeId !== undefined && typeof metadata.failedToolNodeId !== "string" || metadata.invocationCwd !== undefined && typeof metadata.invocationCwd !== "string" || metadata.workflowCwd !== undefined && typeof metadata.workflowCwd !== "string" || metadata.repositoryRoot !== undefined && typeof metadata.repositoryRoot !== "string" || metadata.gitWorktreeRoot !== undefined && typeof metadata.gitWorktreeRoot !== "string")
     return;
   const { origin, possibleStages: rawPossibleStages, ...metadataWithoutOrigin } = metadata;
   return {
@@ -86005,11 +86494,16 @@ function classifyDbosDeletionTombstone(records, workflowId) {
 init_dbos_process_owner();
 
 // dist/builtin/workflows/src/durable/dbos-sdk-handle.ts
-var ATOMIC_EXECUTOR_ID = `atomic-${process.pid.toString(36)}-${crypto.randomUUID().slice(0, 8)}`;
+import { AsyncLocalStorage as AsyncLocalStorage3 } from "node:async_hooks";
+import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
+init_dbos_owner_fence();
+init_dbos_process_owner();
 function getAtomicExecutorId() {
-  return ATOMIC_EXECUTOR_ID;
+  const owner = getDbosProcessOwner();
+  owner.executorId ??= `atomic-db-${crypto.randomUUID()}`;
+  return owner.executorId;
 }
-function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
+function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, fence, previousExecutorIds = []) {
   const checkpointId = (workflowId, stepName) => `${workflowId}:checkpoint:${stepName}`;
   async function stepRecord(status, prefix) {
     if (status.status !== "SUCCESS")
@@ -86023,10 +86517,18 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
     const output = status.output === undefined || typeof status.output === "string" ? await dbos.retrieveWorkflow(id).getResult() : status.output;
     return { stepName, output, completedAt: status.createdAt };
   }
-  return {
+  const raw = {
     launch: () => dbos.launch(),
     shutdown: () => dbos.shutdown(),
     async startWorkflow(workflowId, name, inputs) {
+      if (fence !== undefined) {
+        const existing = await raw.retrieveWorkflow(workflowId);
+        if (existing !== undefined) {
+          if (existing.name !== name || !isDeepStrictEqual2(existing.inputs, inputs))
+            throw new Error("Workflow root identity changed during admission");
+          return;
+        }
+      }
       try {
         await dbos.startWorkflow(mainWorkflow, { workflowID: workflowId })(name, { ...inputs });
       } catch (err) {
@@ -86045,7 +86547,10 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.cancelWorkflow(workflowId, { cancelChildren: true });
     },
     async resumeWorkflow(workflowId) {
-      await dbos.resumeWorkflow(workflowId);
+      if (fence === undefined)
+        await dbos.resumeWorkflow(workflowId);
+      else if (await raw.retrieveWorkflow(workflowId) === undefined)
+        throw new Error("Workflow root is unavailable for resume");
     },
     async listAllWorkflows() {
       const statuses = await dbos.listWorkflows({
@@ -86074,6 +86579,12 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       return status !== undefined && (status.workflowID ?? status.workflowId) === id ? stepRecord(status, prefix) : undefined;
     },
     async recordStepOutput(workflowId, stepName, output) {
+      if (fence !== undefined) {
+        const id = checkpointId(workflowId, stepName);
+        const existing = (await dbos.listWorkflows({ workflowIDs: [id], limit: 1 }))[0];
+        if (existing?.status !== undefined && ["PENDING", "ENQUEUED", "CANCELLED", "ERROR", "DELAYED"].includes(existing.status))
+          await dbos.deleteWorkflows([id], false);
+      }
       let handle;
       try {
         handle = await dbos.startWorkflow(checkpointWorkflow, { workflowID: checkpointId(workflowId, stepName) })(workflowId, stepName, output);
@@ -86097,6 +86608,135 @@ function createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow) {
       await dbos.deleteWorkflows([...new Set([workflowId, ...checkpointIds])], true);
     }
   };
+  if (fence === undefined)
+    return raw;
+  const claims = new AsyncLocalStorage3;
+  const rowAuthority = (workflowId, current) => ({
+    root: workflowId,
+    actor: fence.executorId,
+    ...current.kind === "current" ? { owner: current.metadata.ownerExecutorId, generation: current.generation } : {},
+    enroll: current.kind === "unavailable" || current.kind === "current" && isDatabaseExecutor(current.metadata.ownerExecutorId)
+  });
+  const mutate = async (workflowId, callback, step) => fence.write(workflowId, async () => {
+    const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+    const claimed = claims.getStore();
+    if (claimed === undefined && current.kind === "current" && current.metadata.ownerExecutorId !== fence.executorId)
+      throw new Error("Workflow database ownership changed; stale executor writes are refused");
+    let output = step === undefined ? undefined : classifyLatestMetadata([{ stepName: step.name, output: step.output }], workflowId);
+    let persistedStep = step;
+    if (step !== undefined && output?.kind === "current" && current.kind === "current" && !step.name.endsWith(":claim") && output.metadata.ownerExecutorId === fence.executorId && output.generation <= current.generation) {
+      const updatedAt = Math.max(current.generation + 1, output.metadata.updatedAt, Date.now());
+      persistedStep = {
+        name: metadataStepName(updatedAt),
+        output: encodeMetadata({ ...output.metadata, updatedAt })
+      };
+      output = classifyLatestMetadata([{ stepName: persistedStep.name, output: persistedStep.output }], workflowId);
+    }
+    const authority = claimed?.authority ?? rowAuthority(workflowId, current);
+    const capability = output?.kind === "current" && step?.name.endsWith(":claim") ? {
+      ...authority,
+      claim: output.metadata.transitionClaimId,
+      checkpoint: checkpointId(workflowId, step.name)
+    } : authority;
+    const record = persistedStep;
+    await fence.withRowAuthority(capability, record === undefined ? callback : () => raw.recordStepOutput(workflowId, record.name, record.output));
+    if (claimed !== undefined && output?.kind === "current")
+      claimed.authority = {
+        ...capability,
+        owner: output.metadata.ownerExecutorId,
+        generation: output.generation
+      };
+  });
+  return {
+    ...raw,
+    executorId: fence.executorId,
+    generationLost: () => fence.invalidated,
+    forkGeneration: () => {
+      const next = getDbosProcessOwner().createExecutorFence?.();
+      if (next === undefined)
+        throw new Error("Workflow ownership fence cannot create a recovery generation");
+      fence.close().catch(() => {});
+      return createRealDbosHandle(dbos, mainWorkflow, checkpointWorkflow, next, [
+        ...previousExecutorIds,
+        fence.executorId
+      ]);
+    },
+    adoptPreviousGeneration: async (workflowId) => {
+      if (previousExecutorIds.length === 0)
+        return;
+      return await fence.write(workflowId, async () => {
+        const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+        if (current.kind !== "current" || current.metadata.ownerExecutorId === fence.executorId)
+          return;
+        const previousExecutorId = current.metadata.ownerExecutorId;
+        if (previousExecutorId === undefined || !previousExecutorIds.includes(previousExecutorId))
+          throw new Error("Workflow database ownership changed; stale executor writes are refused");
+        const metadata = {
+          ...current.metadata,
+          ownerExecutorId: fence.executorId,
+          transitionClaimId: crypto.randomUUID(),
+          updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+        };
+        const adopted = await fence.recover(previousExecutorId, async () => {
+          await fence.withRowAuthority({
+            ...rowAuthority(workflowId, current),
+            claim: metadata.transitionClaimId,
+            checkpoint: checkpointId(workflowId, claimMetadataStepName(current.generation))
+          }, () => raw.recordStepOutput(workflowId, claimMetadataStepName(current.generation), encodeMetadata(metadata)));
+          return metadata;
+        });
+        if (adopted === undefined)
+          throw new Error("Workflow previous execution generation is still active");
+        return adopted;
+      }, true);
+    },
+    enrollLegacyWorkflow: async (workflowId, modelOwner) => fence.write(workflowId, async () => {
+      const current = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      if (current.kind !== "current" || isDatabaseExecutor(current.metadata.ownerExecutorId) && current.metadata.legacyRecoveryPending !== true || !["running", "paused", "blocked"].includes(current.metadata.status) || current.metadata.rootWorkflowId !== undefined && current.metadata.rootWorkflowId !== workflowId)
+        return;
+      const metadata = {
+        ...current.metadata,
+        modelOwner,
+        ownerExecutorId: fence.executorId,
+        status: "blocked",
+        resumable: true,
+        legacyRecoveryPending: true,
+        updatedAt: Math.max(Date.now(), current.metadata.updatedAt + 1)
+      };
+      const retry = isDatabaseExecutor(current.metadata.ownerExecutorId);
+      const transitionClaimId = crypto.randomUUID();
+      const stepName = retry ? claimMetadataStepName(current.generation) : metadataStepName(Math.max(current.generation + 1, metadata.updatedAt));
+      const persist = () => fence.withRowAuthority({
+        ...rowAuthority(workflowId, current),
+        enroll: true,
+        ...retry ? { claim: transitionClaimId, checkpoint: checkpointId(workflowId, stepName) } : {}
+      }, () => raw.recordStepOutput(workflowId, stepName, encodeMetadata({ ...metadata, ...retry ? { transitionClaimId } : {} })));
+      if (retry) {
+        const recovered = await fence.recover(current.metadata.ownerExecutorId, async () => {
+          await persist();
+          return true;
+        });
+        if (recovered !== true)
+          return;
+      } else
+        await persist();
+      return metadata;
+    }, true),
+    ownerLiveness: (executorId) => fence.liveness(executorId),
+    withWorkflowClaim: (workflowId, callback) => fence.write(workflowId, async () => {
+      const authoritative = classifyLatestMetadata(await raw.listStepRecords(workflowId), workflowId);
+      const claim = () => claims.run({ authority: { ...rowAuthority(workflowId, authoritative), claim: crypto.randomUUID() } }, callback);
+      if (authoritative.kind === "current" && authoritative.metadata.status === "running" && authoritative.metadata.ownerExecutorId !== fence.executorId) {
+        return await fence.recover(authoritative.metadata.ownerExecutorId, claim) ?? false;
+      }
+      return await claim();
+    }, true),
+    startWorkflow: (id, name, inputs) => mutate(id, () => raw.startWorkflow(id, name, inputs)),
+    cancelWorkflow: (id) => mutate(id, () => raw.cancelWorkflow(id)),
+    resumeWorkflow: (id) => mutate(id, () => raw.resumeWorkflow(id)),
+    recordStepOutput: (id, step, output) => mutate(id, () => raw.recordStepOutput(id, step, output), { name: step, output }),
+    deleteWorkflowData: (id) => mutate(id, () => raw.deleteWorkflowData(id))
+  };
 }
 function isDbosDuplicateWorkflowError(err) {
   const msg = err instanceof Error ? err.message : String(err);
@@ -86178,6 +86818,8 @@ async function configureDbosDurableBackend(config) {
   const sdk = await importDbosSdk();
   const owner = getDbosProcessOwner();
   const existing = owner.wrappers;
+  if (existing !== undefined && owner.executorFence === undefined)
+    throw new Error("Existing workflow executor has no database ownership fence; restart the host before recovering workflows");
   let launch = owner.active?.launch ?? (() => sdk.launch());
   let checkReady;
   if (existing === undefined) {
@@ -86200,12 +86842,30 @@ async function configureDbosDurableBackend(config) {
   if (existing === undefined) {
     owner.wrappers = { mainWorkflow, checkpointWorkflow };
   }
+  let backendFence = owner.executorFence;
+  let backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), {
+    checkReady
+  });
   return {
-    backend: new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow), {
-      checkReady
-    }),
-    launch,
-    shutdown: () => sdk.shutdown()
+    get backend() {
+      return backend;
+    },
+    launch: async () => {
+      await launch();
+      if (backendFence !== owner.executorFence && backendFence?.closed) {
+        backendFence = owner.executorFence;
+        backend = new DbosDurableBackend(createRealDbosHandle(sdk, mainWorkflow, checkpointWorkflow, backendFence), { checkReady });
+      }
+    },
+    shutdown: async () => {
+      const results = await Promise.allSettled([
+        sdk.shutdown(),
+        ...[...owner.executorFences ?? []].map((fence) => fence.close())
+      ]);
+      const errors = results.filter((result) => result.status === "rejected").map((result) => result.reason instanceof Error ? result.reason : new Error(String(result.reason)));
+      if (errors.length > 0)
+        throw new AggregateError(errors, "Workflow database shutdown failed");
+    }
   };
 }
 async function importDbosSdk() {
@@ -86238,13 +86898,18 @@ class DbosDurableBackend {
   unavailableAdmissions = new Set;
   unavailableCheckpoints = new Set;
   pendingRecoveryAdmissions = new Set;
+  ownerLiveness = new Map;
   admissionMetadataAttempted = new Set;
   admissionSettlements = new Map;
   admissionRecoveries = new Map;
   admissionRecoveryControllers = new Map;
+  fixedGeneration = false;
+  generationIsCurrent;
+  rebindInitialAdmission;
+  admitted = false;
   constructor(sdk, options) {
     this.sdk = sdk;
-    this.executorId = options?.executorId ?? getAtomicExecutorId();
+    this.executorId = options?.executorId ?? sdk.executorId ?? getAtomicExecutorId();
     this.onUnavailable = options?.onUnavailable;
     this.checkReady = options?.checkReady;
     this.promptReservations = new DbosPromptReservationTracker({
@@ -86255,6 +86920,55 @@ class DbosDurableBackend {
       }
     });
   }
+  async enrollLegacyWorkflow(workflowId, options) {
+    if (options.olderWorkersStopped !== true || this.sdk.enrollLegacyWorkflow === undefined)
+      return false;
+    this.ensureGeneration();
+    return await boundedAdmission((signal) => dbosAdmissionContext.run(signal, async () => {
+      signal.throwIfAborted();
+      const metadata = await this.sdk.enrollLegacyWorkflow(workflowId, options.modelOwner);
+      signal.throwIfAborted();
+      if (metadata === undefined)
+        return false;
+      this.applyMetadata(workflowId, metadata);
+      this.current.add(workflowId);
+      return true;
+    }), options.signal);
+  }
+  executionView() {
+    if (this.fixedGeneration || this.sdk.forkGeneration === undefined)
+      return this;
+    this.ensureGeneration();
+    const view = new DbosDurableBackend(this.sdk, {
+      executorId: this.executorId,
+      checkReady: this.checkReady,
+      onUnavailable: this.onUnavailable
+    });
+    const reservations = view.promptReservations;
+    Object.assign(view, this);
+    Object.assign(view, {
+      promptReservations: reservations,
+      fixedGeneration: true,
+      generationIsCurrent: () => this.sdk === view.sdk,
+      rebindInitialAdmission: () => {
+        this.ensureGeneration();
+        view.sdk = this.sdk;
+        view.executorId = this.executorId;
+      }
+    });
+    return view;
+  }
+  ensureGeneration() {
+    if (this.fixedGeneration) {
+      if (this.generationIsCurrent?.() === false)
+        throw new DbosDependencyError("Workflow database ownership generation changed; stale execution writes are refused");
+      return;
+    }
+    if (this.sdk.generationLost?.() && this.sdk.forkGeneration !== undefined) {
+      this.sdk = this.sdk.forkGeneration();
+      this.executorId = this.sdk.executorId ?? this.executorId;
+    }
+  }
   isAdmissionUnavailable(workflowId) {
     return this.unavailableAdmissions.has(workflowId);
   }
@@ -86271,6 +86985,8 @@ class DbosDurableBackend {
     return this.admissionSettlements.has(workflowId);
   }
   admitWorkflow(workflowId, registration, signal) {
+    if (!this.admitted)
+      this.rebindInitialAdmission?.();
     const pending = this.performAdmission(workflowId, registration, signal);
     this.admissionSettlements.set(workflowId, pending);
     pending.then(() => {
@@ -86278,6 +86994,7 @@ class DbosDurableBackend {
         this.admissionSettlements.delete(workflowId);
     }, () => {});
     return pending.then(async () => {
+      this.admitted = true;
       await dbosAdmissionContext.run(signal, () => this.flush(workflowId));
       signal.throwIfAborted();
       this.admissionMetadataAttempted.delete(workflowId);
@@ -86298,12 +87015,13 @@ class DbosDurableBackend {
         await this.flushWrites(workflowId);
         signal.throwIfAborted();
       }), signal);
+      this.ensureGeneration();
       this.admissionUnavailable = false;
       this.unavailableAdmissions.delete(workflowId);
       this.unavailableCheckpoints.delete(workflowId);
       this.pendingRecoveryAdmissions.delete(workflowId);
     } catch (error) {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.admissionMetadataAttempted.delete(workflowId);
         this.admissionUnavailable = true;
         this.unavailableAdmissions.add(workflowId);
@@ -86329,6 +87047,7 @@ class DbosDurableBackend {
     });
   }
   registerWorkflow(handle) {
+    this.ensureGeneration();
     if (this.invalid.has(handle.workflowId)) {
       throw new DurableNestedTopologyError(`workflow ${handle.workflowId} contains malformed current DBOS records`);
     }
@@ -86370,6 +87089,7 @@ class DbosDurableBackend {
     return persisted;
   }
   recordCheckpoint(checkpoint) {
+    this.ensureGeneration();
     if (!this.isWorkflowLoadable(checkpoint.workflowId))
       return;
     this.mem.recordCheckpoint(checkpoint);
@@ -86398,7 +87118,7 @@ class DbosDurableBackend {
       });
       signal.throwIfAborted();
     }), options?.signal ?? dbosAdmissionContext.getStore(), undefined, "Workflow database checkpoint timed out. Restore PostgreSQL and inspect the run before resuming; external outcomes may be unknown.").catch((error) => {
-      if (isDbosDependencyError(error)) {
+      if (isDbosDependencyError(error) && this.generationIsCurrent?.() !== false) {
         this.unavailableCheckpoints.add(checkpoint.workflowId);
         const errors = this.writeErrors.get(checkpoint.workflowId);
         if (errors !== undefined)
@@ -86446,12 +87166,14 @@ class DbosDurableBackend {
     return this.mem.listCheckpoints(workflowId);
   }
   getWorkflow(workflowId) {
-    return this.mem.getWorkflow(workflowId);
+    const handle = this.mem.getWorkflow(workflowId);
+    return handle === undefined || this.sdk.ownerLiveness === undefined ? handle : { ...handle, ownerLiveness: this.ownerLiveness.get(handle.ownerExecutorId ?? "") ?? "unknown" };
   }
   getLoadableWorkflow(workflowId) {
-    return this.isWorkflowLoadable(workflowId) ? this.mem.getWorkflow(workflowId) : undefined;
+    return this.isWorkflowLoadable(workflowId) ? this.getWorkflow(workflowId) : undefined;
   }
   setWorkflowStatus(workflowId, status, pendingPrompts, resumable, failure) {
+    this.ensureGeneration();
     if (status === "cancelled" || status === "completed" || resumable === false) {
       this.admissionRecoveryControllers.get(workflowId)?.abort(new Error("Workflow recovery superseded by terminal control."));
     }
@@ -86475,9 +87197,10 @@ class DbosDurableBackend {
       await this.writeMetadata(workflowId);
     });
   }
-  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt) {
+  async transitionWorkflowStatus(workflowId, expected, status, pendingPrompts, resumable, expectedUpdatedAt, modelOwner) {
+    this.ensureGeneration();
     let records = [];
-    return await transitionDbosWorkflowStatus({
+    const transition = () => transitionDbosWorkflowStatus({
       expectedStatuses: expected,
       status,
       flush: () => this.flush(workflowId),
@@ -86491,14 +87214,25 @@ class DbosDurableBackend {
         const pendingPrompts = this.promptReservations.hydrate(workflowId, entry.pendingPrompts, records, entry.promptReservationEpoch);
         this.applyMetadata(workflowId, { ...entry, pendingPrompts });
       },
-      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable),
+      claim: (authoritative, generation) => this.claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner),
       write: async () => {
+        const handle = this.mem.getWorkflow(workflowId);
+        if (handle !== undefined)
+          this.mem.registerWorkflow({
+            ...handle,
+            legacyRecoveryPending: undefined,
+            ...modelOwner !== undefined ? { modelOwner } : {}
+          }, true);
         this.setWorkflowStatus(workflowId, status, pendingPrompts, resumable);
         await this.flush(workflowId);
       }
     });
+    if (this.sdk.withWorkflowClaim === undefined)
+      return await transition();
+    await this.flush(workflowId);
+    return await this.sdk.withWorkflowClaim(workflowId, transition);
   }
-  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable) {
+  async claimStatusTransition(workflowId, authoritative, generation, status, pendingPrompts, resumable, modelOwner) {
     const stepName = claimMetadataStepName(generation);
     const transitionClaimId = crypto.randomUUID();
     const claim = {
@@ -86506,6 +87240,8 @@ class DbosDurableBackend {
       status,
       ...pendingPrompts !== undefined ? { pendingPrompts } : {},
       ...resumable !== undefined ? { resumable } : {},
+      ...modelOwner === undefined ? {} : { modelOwner },
+      legacyRecoveryPending: undefined,
       ownerExecutorId: this.executorId,
       transitionClaimId,
       updatedAt: Math.max(Date.now(), authoritative.updatedAt + 1)
@@ -86647,7 +87383,7 @@ class DbosDurableBackend {
         this.mem.recordCheckpoint(classified.checkpoint);
       }
       const handle = this.getLoadableWorkflow(workflowId);
-      return handle === undefined ? { kind: "malformed" } : { kind: "current", handle };
+      return handle === undefined ? { kind: "malformed" } : await this.withOwnerLiveness(handle);
     }
     const info = await this.sdk.retrieveWorkflow(workflowId);
     if (info !== undefined)
@@ -86670,6 +87406,7 @@ class DbosDurableBackend {
     }
   }
   reconcileWorkflowAdmission(workflowId, signal) {
+    this.ensureGeneration();
     signal?.throwIfAborted();
     if (!this.unavailableAdmissions.has(workflowId) && !this.unavailableCheckpoints.has(workflowId))
       return Promise.resolve();
@@ -86684,11 +87421,13 @@ class DbosDurableBackend {
         return;
       if (metadata.resumable === false || metadata.status === "cancelled" || metadata.status === "completed")
         return;
-      if (!await reconcileDbosAdmission(this.sdk, this.promptReservations.metadata(workflowId, metadata), this.unavailableAdmissions.has(workflowId), this.checkReady)) {
+      if (!await reconcileDbosAdmission(this.sdk, { ...this.promptReservations.metadata(workflowId, metadata), ownerExecutorId: this.executorId }, this.unavailableAdmissions.has(workflowId), this.checkReady)) {
         await this.suppressWorkflow(workflowId);
         return;
       }
       admissionSignal.throwIfAborted();
+      await this.sdk.adoptPreviousGeneration?.(workflowId);
+      admissionSignal.throwIfAborted();
       const info = await this.sdk.retrieveWorkflow(workflowId);
       if (info === undefined)
         return;
@@ -86725,7 +87464,7 @@ class DbosDurableBackend {
       return { kind: deletion === "current" ? "deleted" : "malformed" };
     }
     const metadata = classifyLatestMetadata(records, info.workflowId);
-    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual2(metadata.metadata.inputs, expected.inputs))) {
+    if (metadata.kind !== "current" || expected !== undefined && (metadata.metadata.name !== expected.name || !isDeepStrictEqual3(metadata.metadata.inputs, expected.inputs))) {
       await this.suppressWorkflow(info.workflowId);
       return { kind: "malformed" };
     }
@@ -86759,10 +87498,17 @@ class DbosDurableBackend {
     });
     const handle = this.getLoadableWorkflow(info.workflowId);
     if (handle !== undefined)
-      return { kind: "current", handle };
+      return await this.withOwnerLiveness(handle);
     await this.suppressWorkflow(info.workflowId);
     return { kind: "malformed" };
   }
+  async withOwnerLiveness(handle) {
+    if (this.sdk.ownerLiveness === undefined)
+      return { kind: "current", handle };
+    const ownerLiveness = await this.sdk.ownerLiveness(handle.ownerExecutorId);
+    this.ownerLiveness.set(handle.ownerExecutorId ?? "", ownerLiveness);
+    return { kind: "current", handle: { ...handle, ownerLiveness } };
+  }
   async suppressWorkflow(workflowId) {
     this.invalid.add(workflowId);
     this.current.delete(workflowId);
@@ -86776,10 +87522,21 @@ class DbosDurableBackend {
       return Promise.resolve();
     const previous = this.writeQueues.get(workflowId) ?? Promise.resolve();
     const next = previous.then(async () => {
+      this.ensureGeneration();
+      const adopted = await this.sdk.adoptPreviousGeneration?.(workflowId);
+      const local = this.mem.getWorkflow(workflowId);
+      if (adopted !== undefined && local !== undefined)
+        this.mem.registerWorkflow({
+          ...local,
+          ownerExecutorId: adopted.ownerExecutorId,
+          updatedAt: Math.max(local.updatedAt, adopted.updatedAt + 1)
+        }, true);
       if (!signal?.aborted)
         await fn();
     });
     const tracked = next.catch((err) => {
+      if (this.generationIsCurrent?.() === false)
+        return;
       const error = err instanceof Error ? err : new Error(String(err));
       const errors = this.writeErrors.get(workflowId) ?? [];
       errors.push(error);
@@ -86816,7 +87573,7 @@ class DbosDurableBackend {
   applyMetadata(workflowId, metadata) {
     if (metadata.workflowId !== workflowId)
       return;
-    this.mem.registerWorkflow(metadata);
+    this.mem.registerWorkflow(metadata, true);
   }
 }
 
@@ -86852,7 +87609,7 @@ import { tmpdir, uptime } from "node:os";
 import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute3, join as join5, relative as relative2, sep as sep2 } from "node:path";
 
 // dist/builtin/workflows/src/durable/dbos-embedded-postgres-root.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 import {
   chmod,
   chown,
@@ -87335,8 +88092,8 @@ async function snapshotSourceRuntime(root, publisher, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const sourceHash = createHash2("sha256");
-  const sealedHash = createHash2("sha256");
+  const sourceHash = createHash4("sha256");
+  const sealedHash = createHash4("sha256");
   await hashSourceEntry(sourceHash, sealedHash, root, ".", rootRealPath, publisher, progress);
   return { sourceIdentity: sourceHash.digest("hex"), sealedIdentity: sealedHash.digest("hex") };
 }
@@ -87601,7 +88358,7 @@ async function snapshotSealedManifest(root, progress) {
   const rootStat = await lstat(root);
   assertRuntimeRoot(root, rootStat);
   const rootRealPath = await realpath(root);
-  const hash = createHash2("sha256");
+  const hash = createHash4("sha256");
   const entries = [];
   await hashSealedEntry(hash, root, ".", rootRealPath, progress, entries);
   return { version: 1, sealedIdentity: hash.digest("hex"), entries };
@@ -87835,6 +88592,13 @@ function resolveEmbeddedPostgresTarget(host) {
 init_dbos_admission();
 var HEALTH_INTERVAL_MS = 5000;
 var RECOVERY_ATTEMPTS = 3;
+function isMonitoringConnectionTimeout(error) {
+  if (!(error instanceof Error))
+    return false;
+  if ("code" in error)
+    return error.code === "ETIMEDOUT";
+  return error.message === "timeout expired" || error.message === "Connection terminated due to connection timeout";
+}
 function isMonitoringConnectionFailure(error) {
   if (!(error instanceof Error))
     return false;
@@ -87945,7 +88709,7 @@ class PostgresHealth {
       try {
         identity = await this.operations.probe();
       } catch (retryError) {
-        if (!isMonitoringConnectionFailure(retryError))
+        if (isMonitoringConnectionTimeout(retryError) || !isMonitoringConnectionFailure(retryError))
           throw retryError;
         this.retainFailure(retryError);
         return;
@@ -87971,7 +88735,7 @@ class PostgresHealth {
       if (ready !== undefined)
         return ready;
     } catch (error) {
-      if (isQueryReadTimeout(error)) {
+      if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error)) {
         this.retainFailure(new Error("Managed PostgreSQL did not answer a health check in time."));
         throw this.dependencyFailure("Managed PostgreSQL did not answer a health check in time.");
       }
@@ -88279,7 +89043,7 @@ async function probePostgresIdentity(port) {
     const result = await client.query(POSTGRES_IDENTITY_SQL);
     return result.rows[0];
   } catch (error) {
-    if (isQueryReadTimeout(error))
+    if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
       throw error;
     const code = error instanceof Error && "code" in error ? error.code : undefined;
     if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EPIPE" || code === "57P01" || code === "57P02" || code === "57P03" || error instanceof Error && /timeout|timed out|connection terminated/i.test(error.message))
@@ -88452,7 +89216,7 @@ async function ensureCluster(options = {}) {
         try {
           return await existingServerProbe()(probePort);
         } catch (error) {
-          if (isQueryReadTimeout(error))
+          if (isQueryReadTimeout(error) || isMonitoringConnectionTimeout(error))
             return;
           throw error;
         }
@@ -90568,6 +91332,9 @@ function createDurableAdmissionSettlement(input, signal) {
   };
 }
 
+// dist/builtin/workflows/src/runs/background/quit.ts
+init_dbos_admission();
+
 // dist/builtin/workflows/src/shared/resume-continuation.ts
 var RESUME_CONTINUATION_PROMPT = "Continue where you left off. If you believe you are finished with your original task (or a redefined task if the user told you), stop.";
 
@@ -91954,7 +92721,8 @@ async function quitRunWithAction(runId, opts, action) {
       if (await settle() === "refused")
         return { ok: false, runId, reason: "already_ended" };
     } catch (error) {
-      if (!suspendedByAbort)
+      const alreadyDependencyPaused = isDbosDependencyError(error) && current.status === "paused" && current.phase === "blocked_dependency";
+      if (!suspendedByAbort && !alreadyDependencyPaused)
         throw error;
       const preservedProgress = hasDurableQuitProgress(runId);
       publish(preservedProgress);
@@ -101292,7 +102060,7 @@ function createRegistry(initial = []) {
 
 // dist/builtin/workflows/src/extension/discovery-loaders.ts
 import { readdir as readdir3, stat as stat2 } from "node:fs/promises";
-import { extname, isAbsolute as isAbsolute14, join as join30, resolve as resolve14 } from "node:path";
+import { extname, isAbsolute as isAbsolute14, join as join30, resolve as resolve15 } from "node:path";
 
 // ../../node_modules/jiti/lib/jiti-static.mjs
 var import_jiti = __toESM(require_jiti(), 1);
@@ -101747,12 +102515,12 @@ function raceAbort2(promise, signal) {
   });
 }
 // dist/builtin/workflows/src/runs/foreground/executor-hil.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash5 } from "node:crypto";
 import { createAskUserQuestionToolDefinition } from "@bastani/atomic";
 
 // dist/builtin/workflows/src/shared/prompt-callsite-context.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-var promptCallerStacks = new AsyncLocalStorage2;
+import { AsyncLocalStorage as AsyncLocalStorage4 } from "node:async_hooks";
+var promptCallerStacks = new AsyncLocalStorage4;
 function withPromptCallerStack(stack, delegate) {
   if (stack === undefined)
     return delegate();
@@ -102046,7 +102814,7 @@ function makePrompt(descriptor) {
   };
 }
 function stableHash(value2) {
-  return createHash3("sha256").update(JSON.stringify(value2)).digest("hex").slice(0, 32);
+  return createHash5("sha256").update(JSON.stringify(value2)).digest("hex").slice(0, 32);
 }
 function promptDescriptorHash(descriptor) {
   if (isCustomPromptDescriptor(descriptor)) {
@@ -106900,6 +107668,16 @@ function workflowStartupFailureMessage(admission, snapshotError, fallback) {
 // dist/builtin/workflows/src/durable/resume-runtime.ts
 init_dbos_admission();
 
+// dist/builtin/workflows/src/durable/sdk-recovery-scope.ts
+init_dbos_owner_fence();
+import { resolve as resolve13 } from "node:path";
+function isSdkDurableRunInScope(handle, cwd) {
+  return cwd !== undefined && handle.invocationCwd !== undefined && resolve13(cwd) === resolve13(handle.invocationCwd) && handle.modelOwner !== undefined && (handle.rootWorkflowId === undefined || handle.rootWorkflowId === handle.workflowId);
+}
+function isSdkCrashedRunAdoptable(handle, cwd) {
+  return isSdkDurableRunInScope(handle, cwd) && handle.status === "running" && handle.ownerExecutorId !== undefined && handle.ownerExecutorId !== getAtomicExecutorId() && !isLiveRunningWorkflow(handle) && isDatabaseExecutor(handle.ownerExecutorId) && handle.ownerLiveness === "dead";
+}
+
 // dist/builtin/workflows/src/durable/tool-resume-frontier.ts
 function resolveToolResumeFrontier(source, backend) {
   const fail = (detail) => ({
@@ -107083,6 +107861,11 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       message: `Workflow ${resolved.workflowId} is ${handle.status}, not resumable.`
     };
   }
+  const requestedOwner = deps.baseRunOpts.modelOwner;
+  const adopting = requestedOwner !== undefined && requestedOwner !== handle.modelOwner && (handle.modelOwner !== undefined || handle.origin === "agent");
+  if (adopting && !isSdkCrashedRunAdoptable(handle, deps.baseRunOpts.cwd)) {
+    return { ok: false, reason: "owned_elsewhere", message: "Workflow instance belongs to another caller/session." };
+  }
   const def = handle.invocationCwd === undefined ? deps.registry.get(handle.name) : await deps.resolveDefinition?.(handle.name, handle.invocationCwd) ?? deps.registry.get(handle.name);
   if (def === undefined) {
     return { ok: false, reason: "workflow_not_found", message: `Workflow definition not found: ${handle.name}` };
@@ -107132,6 +107915,22 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     failedToolNodeId: handle.failedToolNodeId
   };
   const sourceSnapshot = toolContinuation?.source ?? deps.baseRunOpts.store?.runs().find((run) => run.id === resolved.workflowId);
+  let adoptedClaimUpdatedAt;
+  const rollbackStartup = async (onRestored) => {
+    if (adopting) {
+      const current = backend.getWorkflow(resolved.workflowId);
+      if (adoptedClaimUpdatedAt === undefined || current?.modelOwner !== requestedOwner)
+        return false;
+      const restored = await backend.transitionWorkflowStatus(resolved.workflowId, ["running"], handle.status, handle.pendingPrompts, handle.resumable, adoptedClaimUpdatedAt);
+      if (restored)
+        onRestored?.();
+      return restored;
+    }
+    backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
+    await backend.flush(resolved.workflowId);
+    onRestored?.();
+    return true;
+  };
   let claimed;
   try {
     claimed = await boundedAdmission((signal) => dbosAdmissionContext.run(signal, async () => {
@@ -107142,10 +107941,14 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       }
       unsettled.add(resolved.workflowId);
       try {
-        const accepted = await backend.transitionWorkflowStatus(resolved.workflowId, [handle.status], "running", undefined, undefined, resolved.updatedAt);
-        if (accepted && signal.aborted && backend.getWorkflow(resolved.workflowId)?.status === "running") {
-          backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-          await backend.flush(resolved.workflowId);
+        const accepted = await backend.transitionWorkflowStatus(resolved.workflowId, [handle.status], "running", undefined, undefined, resolved.updatedAt, adopting ? requestedOwner : undefined);
+        if (accepted && adopting) {
+          const current = backend.getWorkflow(resolved.workflowId);
+          if (current?.status === "running" && current.modelOwner === requestedOwner)
+            adoptedClaimUpdatedAt = current.updatedAt;
+        }
+        if (accepted && !adopting && signal.aborted && backend.getWorkflow(resolved.workflowId)?.status === "running") {
+          await rollbackStartup();
         }
         return accepted;
       } finally {
@@ -107172,7 +107975,7 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     ...deps.baseRunOpts,
     ...handle.invocationCwd !== undefined ? { cwd: handle.invocationCwd } : {},
     ...handle.origin !== undefined ? { origin: handle.origin } : {},
-    modelOwner: handle.modelOwner,
+    modelOwner: adopting ? requestedOwner : handle.modelOwner,
     runId: resolved.workflowId,
     durableBackend: backend,
     ...toolContinuation === undefined ? {} : { continuation: toolContinuation }
@@ -107198,10 +108001,10 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
       }
     });
   } catch (error) {
-    backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-    await backend.flush(resolved.workflowId);
-    if (sourceSnapshot !== undefined)
-      deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+    await rollbackStartup(() => {
+      if (sourceSnapshot !== undefined)
+        deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+    });
     return {
       ok: false,
       reason: "startup_failed",
@@ -107215,12 +108018,14 @@ async function resumeDurableWorkflowClaimed(workflowId, deps, catalog) {
     const snapshot = deps.baseRunOpts.store?.runs().find((run) => run.id === accepted.runId);
     const error = workflowStartupFailureMessage(admission, snapshot?.error, `Workflow ${resolved.workflowId} ended before startup admission`);
     if (!backend.isAdmissionUnavailable?.(resolved.workflowId)) {
-      if (sourceSnapshot === undefined)
+      if (!adopting && sourceSnapshot === undefined)
         deps.baseRunOpts.store?.removeRun(accepted.runId);
-      backend.setWorkflowStatus(resolved.workflowId, handle.status, handle.pendingPrompts, handle.resumable, sourceFailure);
-      await backend.flush(resolved.workflowId);
-      if (sourceSnapshot !== undefined)
-        deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+      await rollbackStartup(() => {
+        if (adopting && sourceSnapshot === undefined)
+          deps.baseRunOpts.store?.removeRun(accepted.runId);
+        if (sourceSnapshot !== undefined)
+          deps.baseRunOpts.store?.recordRunStart(sourceSnapshot);
+      });
     }
     return {
       ok: false,
@@ -112626,9 +113431,9 @@ class StageSessionController {
 }
 
 // dist/builtin/workflows/src/runs/foreground/stage-runner-output.ts
-import { createHash as createHash4 } from "node:crypto";
+import { createHash as createHash6 } from "node:crypto";
 import { mkdir as mkdir7, writeFile as writeFile11 } from "node:fs/promises";
-import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute13, join as join29, resolve as resolve13 } from "node:path";
+import { basename as basename6, dirname as dirname13, isAbsolute as isAbsolute13, join as join29, resolve as resolve14 } from "node:path";
 var DEFAULT_MAX_OUTPUT_BYTES = 200 * 1024;
 var DEFAULT_MAX_OUTPUT_LINES = 5000;
 function normalizeMaxOutput2(maxOutput) {
@@ -112692,7 +113497,7 @@ function formatByteSize(bytes) {
   return `${value2.toFixed(1)} ${units[unitIndex]}`;
 }
 function transcriptPath(runId, outputPath) {
-  const digest = createHash4("sha256").update(outputPath).digest("hex").slice(0, 16);
+  const digest = createHash6("sha256").update(outputPath).digest("hex").slice(0, 16);
   return join29(workflowArtifactRunPath(runId), "transcripts", `${digest}-${basename6(outputPath)}.transcript.md`);
 }
 function appendContent(lines, content) {
@@ -112738,7 +113543,7 @@ function renderTranscript(messages, fallbackOutput) {
 `);
 }
 function savedOutputReference(outputPath, fullOutput, transcriptPathValue, transcriptText, transcriptAvailable, warning) {
-  const absolutePath = resolve13(outputPath);
+  const absolutePath = resolve14(outputPath);
   const bytes = Buffer.byteLength(fullOutput, "utf8");
   const lines = countLines(fullOutput);
   const transcriptBytes = Buffer.byteLength(transcriptText, "utf8");
@@ -112753,8 +113558,8 @@ function resolveOutputPath(output, runtimeCwd, requestedCwd) {
     return;
   if (isAbsolute13(output))
     return output;
-  const baseCwd = requestedCwd === undefined ? runtimeCwd : isAbsolute13(requestedCwd) ? requestedCwd : resolve13(runtimeCwd, requestedCwd);
-  return resolve13(baseCwd, output);
+  const baseCwd = requestedCwd === undefined ? runtimeCwd : isAbsolute13(requestedCwd) ? requestedCwd : resolve14(runtimeCwd, requestedCwd);
+  return resolve14(baseCwd, output);
 }
 function degenerateWarning(fullOutput) {
   return fullOutput.trim().length === 0 ? "WARNING: the stage artifact is empty; search the companion transcript for this stage's work." : undefined;
@@ -113794,7 +114599,8 @@ async function run(def, inputs, opts = {}) {
     ownController.abort(callerSignal?.reason);
   };
   const exit = createWorkflowExitManager({ runId, exitScope, controller: ownController });
-  const backendView = opts.durableBackend ?? getDurableBackend();
+  const sourceBackend = opts.durableBackend ?? getDurableBackend();
+  const backendView = sourceBackend.executionView?.() ?? sourceBackend;
   const rootBackend = opts.durableRootBackend ?? backendView;
   const durableBackend = opts.durableScope !== undefined ? new ScopedDurableBackend(backendView, opts.durableScope) : backendView;
   const inheritedElapsedMs = opts.parentRun === undefined ? inheritedRunElapsedMs({ backend: durableBackend, runId, continuationSource: opts.continuation?.source }) : undefined;
@@ -114554,6 +115360,17 @@ async function run(def, inputs, opts = {}) {
     const gracefulQuit = observedQuitCancellation() ?? observedTaskTailQuit ?? findWorkflowGracefulQuit(err) ?? findWorkflowGracefulQuit(ownController.signal.reason);
     if (gracefulQuit !== undefined)
       return suspendForGracefulQuit(gracefulQuit);
+    if (isDbosDependencyError(err) && durableBackend.isCheckpointUnavailable?.(runId) && (durableBackend.getWorkflow(runId)?.completedCheckpoints ?? 0) > 0) {
+      await admittedTools.closeAndDrain();
+      activeStore.recordRunPaused(runId, undefined, { resumable: true });
+      activeStore.recordRunExecutionState(runId, { phase: "blocked_dependency", dependencyError: err.message });
+      return {
+        runId,
+        status: "paused",
+        stages: [...runSnapshot.stages],
+        toolNodes: [...runSnapshot.toolNodes ?? []]
+      };
+    }
     await admittedTools.closeAndDrain();
     if (ownController.signal.aborted)
       await Promise.allSettled([...pendingChildWorkflows]);
@@ -114892,7 +115709,7 @@ async function loadFromPaths(pathsOrMap, kind, baseCwd, diagnostics) {
   const all = [];
   const entries = Array.isArray(pathsOrMap) ? pathsOrMap.map((p) => ({ rawPath: p })) : Object.entries(pathsOrMap).map(([name, p]) => ({ rawPath: p, configuredName: name }));
   for (const { rawPath, configuredName } of entries) {
-    const absPath = isAbsolute14(rawPath) ? rawPath : resolve14(baseCwd, rawPath);
+    const absPath = isAbsolute14(rawPath) ? rawPath : resolve15(baseCwd, rawPath);
     let pathStats;
     try {
       pathStats = await stat2(absPath);
@@ -115665,7 +116482,8 @@ function createDurableResumeRuntime(deps) {
           baseRunOpts: {
             ...deps.baseRunOpts(options?.policy),
             ...options?.budget === undefined ? {} : { budget: options.budget },
-            ...options?.actor === undefined ? {} : { resumeActor: options.actor }
+            ...options?.actor === undefined ? {} : { resumeActor: options.actor },
+            ...options?.modelOwner === undefined ? {} : { modelOwner: options.modelOwner }
           },
           durableBackend: backend,
           resolveDefinition: async (name, cwd) => (await discoverWorkflows({ cwd: cwd ?? deps.runtimeCwd })).registry.get(name),
@@ -116050,7 +116868,7 @@ function createStatusWriter(store, config, opts = {}) {
 import { readFileSync as readFileSync7 } from "node:fs";
 import { readFile as readFile6 } from "node:fs/promises";
 import { homedir as homedir3 } from "node:os";
-import { join as join33, resolve as resolve15 } from "node:path";
+import { join as join33, resolve as resolve16 } from "node:path";
 import { getAgentDir as getAgentDir3, getAgentDirs as getAgentDirs3, getProjectConfigDirs, SettingsManager } from "@bastani/atomic";
 var DATABASE_SETTING_KEYS = new Set(["systemDatabaseUrl", "systemDatabaseUrlFile"]);
 function databaseSettings(settings) {
@@ -116099,7 +116917,7 @@ async function resolveWorkflowDatabaseSettings(global2, project, directories) {
     if (typeof file !== "string" || file.trim() === "") {
       throw new TypeError("workflows.durability.systemDatabaseUrlFile must be a non-empty path");
     }
-    const path = file.startsWith("~/") || file.startsWith("~\\") ? join33(homedir3(), file.slice(2)) : resolve15(projectDatabase === undefined ? directories.global : directories.project, file);
+    const path = file.startsWith("~/") || file.startsWith("~\\") ? join33(homedir3(), file.slice(2)) : resolve16(projectDatabase === undefined ? directories.global : directories.project, file);
     try {
       value2 = await readFile6(path, "utf8");
     } catch {
@@ -121049,7 +121867,7 @@ function createSessionRunControl(host) {
       const ctx = executeContext(host.context());
       if (args.runId !== undefined && (args.action === "status" || args.action === "stages"))
         rejectUnknownRunPrefix(host.store, args.runId);
-      return await host.execute(args, ctx);
+      return await host.execute(args, ctx, undefined, undefined, "sdk");
     } catch (error) {
       throw error instanceof Error ? translateThrown(error, args.runId) : error;
     }
@@ -121100,7 +121918,8 @@ function createSessionRunControl(host) {
         action: "resume",
         runId,
         ...options?.stageId === undefined ? {} : { stageId: options.stageId },
-        ...options?.message === undefined ? {} : { message: options.message }
+        ...options?.message === undefined ? {} : { message: options.message },
+        ...options?.legacyRecovery === undefined ? {} : { legacyRecovery: options.legacyRecovery }
       }));
     }
   };
@@ -121109,6 +121928,32 @@ function createSessionRunControl(host) {
 // dist/builtin/workflows/src/extension/workflow-tool.ts
 import { getSupportedThinkingLevels } from "@bastani/pi-ai/compat";
 
+// dist/builtin/workflows/src/extension/workflow-legacy-recovery.ts
+init_dbos_owner_fence();
+async function enrollLegacySdkRecovery(args, ctx, access, runtime, owner, signal) {
+  const id = args.runId;
+  signal?.throwIfAborted();
+  if (access !== "sdk" || args.action !== "resume" || args.legacyRecovery?.olderWorkersStopped !== true || args.stageId !== undefined || args.all === true || id === undefined || !isFullRunId(id)) {
+    throw new WorkflowInstanceOwnershipError("Legacy recovery requires an SDK root resume with its full UUID and confirmation that older workers have stopped.");
+  }
+  if (owner.store.runs().some((run) => run.id === id)) {
+    throw new WorkflowInstanceOwnershipError("Legacy enrollment cannot replace a locally attached workflow executor.");
+  }
+  const inspected = await runtime.inspectDurableWorkflow(id);
+  if (inspected.kind !== "found")
+    throw new WorkflowInstanceOwnershipError(inspected.message);
+  const backend = getDurableBackend();
+  const handle = backend.getLoadableWorkflow(id);
+  const interruptedEnrollment = handle?.legacyRecoveryPending === true && handle.ownerLiveness === "dead" && ["blocked", "paused"].includes(handle.status);
+  if (handle === undefined || !isSdkDurableRunInScope(handle, typeof ctx.cwd === "string" ? ctx.cwd : undefined) || handle.ownerExecutorId === undefined || isDatabaseExecutor(handle.ownerExecutorId) && !interruptedEnrollment || !["running", "paused", "blocked"].includes(handle.status) || backend.enrollLegacyWorkflow === undefined) {
+    throw new WorkflowInstanceOwnershipError("Legacy recovery is unavailable for this run or working directory; inspect it without taking ownership.");
+  }
+  signal?.throwIfAborted();
+  if (!await backend.enrollLegacyWorkflow(id, { olderWorkersStopped: true, modelOwner: workflowCaller(ctx), signal })) {
+    throw new WorkflowInstanceOwnershipError("Legacy workflow ownership changed while enrollment was pending; inspect it again before retrying.");
+  }
+}
+
 // dist/builtin/workflows/src/extension/workflow-status-summary.ts
 var workflowStatusRenderRuns = new WeakMap;
 function setWorkflowStatusRenderRuns(result, runs) {
@@ -122579,7 +123424,7 @@ function durableInspectionError(action, runId, message) {
 }
 function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflowResourcesLoaded = () => {}, owner = captureWorkflowOwnerResources()) {
   const { store, toolControlRegistry } = owner;
-  return async function executeWorkflowTool(args, ctx, signal, onRunAccepted) {
+  return async function executeWorkflowTool(args, ctx, signal, onRunAccepted, access) {
     signal?.throwIfAborted();
     if (args.action === undefined)
       return {
@@ -122599,7 +123444,13 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
         stages: []
       };
     }
-    const authorize = (id) => assertWorkflowInstanceOwner(id, ctx, store);
+    const recoveryCwd = typeof ctx.cwd === "string" ? ctx.cwd : undefined;
+    const authorize = (id) => {
+      const handle = getDurableBackend().getLoadableWorkflow(id);
+      if (access === "sdk" && isFullRunId(args.runId?.trim() ?? "") && (action === "status" || action === "stages" || action === "resume" && handle !== undefined && isSdkCrashedRunAdoptable(handle, recoveryCwd)) && !store.runs().some((run) => run.id === id) && handle !== undefined && isSdkDurableRunInScope(handle, recoveryCwd))
+        return;
+      assertWorkflowInstanceOwner(id, ctx, store);
+    };
     if (action === "status" && args.runId === undefined) {
       for (const run of topLevelWorkflowRuns(store.runs()))
         authorize(run.id);
@@ -122614,8 +123465,16 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
       }
     }
     const policy = workflowPolicyFromContext(ctx);
-    const getRuntime = () => typeof runtime === "function" ? runtime(ctx) : runtime;
     const awaitRequest = (operation) => raceAbort(operation, signal);
+    const getRuntime = () => {
+      const resolved = typeof runtime === "function" ? runtime(ctx) : runtime;
+      if (access !== "sdk")
+        return resolved;
+      return {
+        ...resolved,
+        resumeDurableWorkflow: (id, options) => resolved.resumeDurableWorkflow(id, { ...options, modelOwner: workflowCaller(ctx) })
+      };
+    };
     const ensureWorkflowResourcesVisible = async () => {
       try {
         await awaitRequest(Promise.resolve(ensureWorkflowResourcesLoaded()));
@@ -122721,6 +123580,9 @@ function makeExecuteWorkflowTool(runtime, reloadWorkflowResources, ensureWorkflo
       case "quit":
         return awaitRequest(workflowQuitAction(args, owner, { getRuntime, authorize }));
       case "resume":
+        if (args.legacyRecovery !== undefined) {
+          await awaitRequest(enrollLegacySdkRecovery(args, ctx, access, getRuntime(), owner, signal));
+        }
         return awaitRequest(workflowResumeAction(args, {
           getRuntime,
           policy,